_{Four requests are stopped at the trust boundary. One passes through a gap in the check and reaches the system. That gap is CVE-2026-52021.}

_{Kumar Mohit  ·  also known as Mohit Narayan  ·  India}

Most of my work sits where untrusted code meets the system running it: secure code review, hardening containers that execute other people's code, and wiring scanners into CI so problems fail the build instead of reaching production.

Security Engineer at Appfend.

_{CWE-306, Missing Authentication for a Critical Function  ·  code100x/cms  ·  assigned by MITRE, published August 2026}

The Next.js middleware guarding the mobile API tested only that an Auth-Key header was present, never that it was correct:

if (req.headers.get('Auth-Key')) {
  return NextResponse.next();   // presence is not validity
}

Any arbitrary value passed the check. Handlers behind that guard then trusted a client-supplied header to decide who the caller was, so a fail-open gate plus downstream trust in client input chained into impersonation and unauthenticated reads of protected data.

flowchart LR
    A["Attacker<br/>Auth-Key: anything"] --> B{"withMobileAuth<br/>middleware"}
    B -->|"header is present<br/>so the check passes"| C["Route handler"]
    B -.->|"value is never compared<br/>against a secret"| F["CWE-306<br/>fail-open"]
    C -->|"trusts client-supplied<br/>identity header"| D[("Protected<br/>course data")]
    C --> E["Impersonate<br/>any user"]

Read the full CVE-2026-52021 disclosure writeup

_{Built at Appfend, a multi-tenant platform that runs untrusted tenant code. Descriptions are capability-level; the code is the company's.}

Behavioral vulnerability validator  _{Go chromedp} A binary that proves a vulnerability is genuinely exploitable rather than merely present. It drives real browser flows headlessly and runs differential analysis against vulnerable and patched builds of the same target, so a finding only passes when the exploit works against one and fails against the other.

Fail-closed LLM reverse proxy  _Go A gateway in front of model backends that denies by default. Unknown routes and methods are rejected rather than forwarded, and upstream failure surfaces as a clean error instead of leaking the backend. The property worth having: a misconfiguration produces a closed door, not an open one.

Container hardening for untrusted workloads  _{Docker ECR} Removed sudo, stripped SUID/SGID bits, restricted the validator binary to root-only, and moved boot secrets behind encryption so they are not readable from a compromised tenant context. Published the hardened base image to ECR.

LLM-as-judge code review grading  _{Python Gitea} Automated grading of submitted pull requests against per-exercise rubrics, with a fail-safe default so a misconfigured grader falls back to the restrictive path instead of passing everything.

DevSecOps detect-and-gate curriculum Hands-on material covering SAST, SCA, SBOM, IaC scanning, secrets detection, and artifact signing, with a four-tier verification methodology so every exercise is proven to work before it ships.

Going deep on AWS security with hands-on Terraform rather than console clicking, and doing regular vulnerability research in container runtimes: runc, Kata Containers, containerd. Staying on one codebase long enough to understand it beats spraying reports across many. The CVE above came from that change of approach.

LinkedIn  ·  TryHackMe  ·  Credly  ·  X  ·  mohit724196@gmail.com